The Complete Guide to Linux System Administration

6-1

Chapter 6 Managing Processes At a Glance

Overview Objectives Quick Quizzes Discussion Questions

Lecture Notes Overview

Chapter 6 covers process and memory management in Linux. The first section defines processes and related terms such as process identifier (PID) and swap space. The ps command is used to view process information in Linux. Students will learn to use this command as well as others, such as top, that provide detailed information about processes. They will learn that process priority controls which processes get the largest slice of CPU time. The nice and renice commands are used to set the priority of processes. Graphical utilities can be used to view and manage process information. Next, students will learn about memory management in Linux. The final section covers scheduling jobs using the at, batch, and crontab commands.

Chapter Objectives
Define processes as used by the Linux kernel View and control running processes using command-line and graphical utilities Understand and manage how memory is used by Linux processes Schedule delayed execution of processes

Defining Processes The Linux Multitasking Model

A process is a program that is running on a Linux system. Linux is a multitasking system. On a machine with a single processor, multitasking is implemented by allowing each process to do its work in a time slice of a few microseconds each. All processes but one are paused by the kernel while one process executes, then that process is paused and another is allowed to execute.

Creating Processes
Each process has a unique process identifier (PID). The init process is the first process started by the Linux kernel and has a PID of 1. All processes are descended from the init process by forking, or creating new child processes. When a process ends, it exits, and all of the resources it used are returned to the kernel for use by other processes.

The Complete Guide to Linux System Administration

6-2

Process States
Processes may be in one of four states: running, sleeping, stopped, or zombie. A running process is currently executing or waiting for the kernel to assign it a time slice. A sleeping process is waiting for something to happen (but not for the kernel to give it a time slice). Processes commonly wait for input and output channels to become available. A stopped process has been stopped before exiting normally. A zombie process is no longer active, but the kernel is still holding on to resources allocated to the process. The kernel regularly cleans up zombie processes.

Swap Space
When the memory requirements of processes are greater than the available memory, the kernel uses the virtual memory or swap space to temporarily hold programs and data. The swap space is typically a separate hard disk partition, called the swap partition. A process that has been placed in the swap space has been swapped out. It cannot start running again until it is swapped back in to physical memory. When the kernel spends too much time moving processes to and from the swap space, the system is said to be thrashing.

Managing Linux Processes Starting Processes from the Shell

When starting a program from the shell, options can be used to control how the program runs. Entering the name of the program or command causes the shell to be busy running the command. The program can be run in the background by typing an & after the program name. This causes the shell to run the program and immediately display another prompt. Multiple processes started from a single shell are called jobs. The jobs command is used to view all jobs started in a shell. If the user has started a program in the foreground, she can type Ctrl+Z to suspend the job and the bg command to place it in the background. When a job is suspended using Ctrl+Z, it is in a stopped state. The fg command can be used to place a job in the foreground. The series of steps on pages 239 to 240 demonstrate putting processes in the background and foreground. When using bg and fg, either the job number (obtained from the jobs command) or the PID (obtained from the ps command) must be used to identify the process. Virtual consoles are used to work in multiple text-mode sessions at the same time. Linux typically starts six virtual consoles that are accessed using the F1 through F6 keys. For example, the Alt+F2 command is used to access the second virtual console. Each virtual console starts a separate copy of the bash shell.

Learning about Processes via the Command-line

The ps command is used to view information about processes. A sample ps output is displayed on the middle of page 241. Command-line options control what information is displayed by ps. The output of the ps command with the aux options is shown on page 242. Using the a and x options causes daemon processes to be shown. These processes wait for certain system activities to occur and then act on them. The f option is used to show relationships between processes, as shown on pages 242 to 243. Table 6-1 summarizes options to the ps command. Table 6-2 lists the fields that can be displayed by the ps command. The o option is used to select the fields to be displayed. Table 6-3 shows ps options that cause various types of output to be displayed. When interpreting the data displayed by ps, it is important to understand the meaning of each field. The %CPU field compares the amount of CPU time used by a process with the total time elapsed since the previous computation of the %CPU field; it does not show the amount of CPU time the process has used since it was started. The %WCPU field is more helpful for showing the overall usage pattern for a process. The TIME field shows a cumulative measure of the CPU time used by the process.

The Complete Guide to Linux System Administration

6-3

Another place to obtain information about processes is the /proc file system. In order to view this information, the PID is required. A subdirectory of /proc is created for each process with the name /proc/PID (for example, /proc/1066). The files in this subdirectory contain information about the process. Many of the files are difficult to interpret, and Chapter 15 contains more details on the /proc file system. Note that the /proc file system does not contain actual files, but is accessed like any Linux directory. The top command is used to view information about CPU utilization by process. The list of processes returned by this command is arranged in descending order, with the process that consumes the most CPU time at the top. The information is updated regularly. The top command cannot be run in the background, since it continuously prints information to the screen.

Controlling Processes
The kill command is used to send a signal to a process. There are about 30 different signals, though many of them are infrequently used. The kill l command can be used to view a list of signals. Two important signals for ending processes are SIGTERM and SIGKILL. SIGTERM is sent to the process and asks the process to terminate. This gives the process a chance to save data, release resources, etc., before exiting. The SIGKILL signal is executed by the kernel and kills the process immediately. Since the process does not have an opportunity to save data or clean up, it is best to try SIGTERM first. The killall command can be used to kill all processes descended from a single process. A complete list of signals can be found at: http://www.comptechdoc.org/os/linux/howlinuxworks/linux_hlprocess.html. A process priority determines how much CPU time is allocated to the process. Another name for priority is the nice level. A higher nice level means that the process will yield CPU time to other processes. Administrators may change the priority of any process, while regular users may change the priority of processes they create. The standard nice level is 0. The highest level is 20. The nice command is used to start a process with an altered nice level. By default, the command starts the process with a nice level of 10. Options to the command are used to change this default. The renice command is used to change the nice level for a process that is already started. Pages 250 and 251 contain examples of using nice and renice. Administrators can alter process priority while using the top command. Pages 251 to 252 outline the procedure for altering process priority in a top session. Table 6-4 lists interactive commands in top.

Using Graphical Process Management Tools

In addition to command-line process management tools, GUI process management tools are available for use with Linux. For the KDE desktop, the KDS System Guard allows administrators to view and modify processes. Figure 6-2 and 6-3 are screen shots from this program. In the GNOME desktop, the GNOME System Monitory provides similar functionality. Figures 6-4 and 6-5 show this program. Another utility for process monitoring/management is GKrellM System Monitor. Many administrators monitor system load constantly by keeping a graphical utility displaying process on their Panel. When the administrator notices a process that may be taking too many resources, he can use the top or ps command to find more information about the process. Tips for effectively managing system load are listed on pages 257 to 258.

The Complete Guide to Linux System Administration

6-4

A list of commands associated with process management can be found at: http://www.comptechdoc.org/os/linux/commands/linux_crprocman.html.

Quick Quiz
1. 2. 3. 4. What are the four states for Linux processes? ANSWER: Running, sleeping, stopped, and zombie _____ occurs when the kernel spends so much time moving processes to and from the swap space that the kernel and the processes bog down and work inefficiently. ANSWER: Thrashing The _____ command lists the processes that are currently running on your Linux system. ANSWER: ps True or False: The SIGKILL signal is handled by the process to which it is sent. ANSWER: False

Managing Memory Understanding Shared Libraries

In addition to managing processes, administrators must manage memory. Libraries contain prewritten functionality that programs can use. Linux includes libraries to access files, to create network connections, to display text, and hundreds of other functions. Statically linked applications contain all of the program code required by the application, including libraries. Dynamically linked applications rely on libraries that exist in the system. These are called shared libraries. Running multiple applications that are dynamically linked to the same libraries requires less memory than running multiple statically linked applications. The ldd command can be used to see the libraries that a program requires.

Understanding Paged Memory

When physical memory is fully utilized, the kernel moves information to the swap partition. Information is moved in 4-KB increments known as pages. Swapping pages of an application, rather than the whole application, improves the performance of the Linux system. Students can read more about swapping at: http://www.linuxtutorial.info/modules.php?name=Tutorial&pageid=311.

Tracking Memory Usage

The free command is used to display information about RAM and virtual memory. A sample output for this command is shown at the bottom of page 260. Page 261 contains an explanation of the information displayed by the free command. If the Swap column of the free command output is very small, the system is in danger of running out of RAM and virtual memory, causing the kernel to crash. Several fields of the ps command can be used to view memory information, including %MEM, STAT, and RSS.

The Complete Guide to Linux System Administration

6-5

Viewing Virtual Memory Information

The vmstat command displays detailed information about how swap space is being used. vmstat can be run as a regular command, where the information is averaged over time since the system started, or the output can be continuously updated and displayed as when using top. Page 262 shows the output of the vmstat command and an explanation of the fields is provided on pages 262 to 263.

Scheduling Processes
Linux provides the ability to schedule processes to start at a later time. Processes can be scheduled to execute once using the at command or regularly using the crontab command. Both commands rely on background processes to check for and execute scheduled tasks. Another name for a scheduled task is a job, and the terms at job and cron job are commonly used.

Automating One-time Tasks

When creating a job with at, the commands to create the job may either be entered on the command-line or placed in a file. The f option is used to specify a file name. The atd daemon checks once per minute for scheduled jobs and executes them. Table 6-5 shows examples of the time specifications used for the at command. In order to use at interactively, the f option is omitted and the command(s) are entered at the at prompt. The results of the command scheduled with at will be e-mailed to the user who issued the command. Alternatively, the tty command can be used to send a message to a terminal instead. The batch command is similar to at in that it is used to execute a one-time task. Rather than perform the task at a specific time, batch executes the job when average system load falls below 0.8. Commands to be executed using batch may be entered at the command-line or from a file (using the f option).

Automating Recurring Tasks

The crontab command is used to automate recurring tasks. Many Linux distributions provide an alternative to crontab. Red Hat Linux creates subdirectories of /etc named cron.hourly, cron.daily, cron.weekly, and cron.monthly. The user can place a file containing commands in one of these subdirectories and the commands will be executed on a regular basis depending on which directory is used. Linux systems include a sample crontab file named the /etc/crontab. This illustrates the syntax for the crontab command as shown on the top of page 269. The scheduled time for a crontab script is specified using five fields: minute, hour, day, month, and day of the week. An asterisk (*) can be used in any of these fields, meaning that the task should be executed regardless of the time in the field. Figure 6-7 dissects an example crontab time specification. The crond daemon compares the system time to the time specified in the crontab file and executes the commands when the time matches. Unlike at and batch jobs, cron jobs cannot be entered on the command-line, they must be placed in a file.

Managing Automated Tasks

All of the commands that you submit using at or crontab are stored in a subdirectory of /var/spool. at jobs contain all of the environment variables needed to execute the job. cron jobs contain a more limited set of information. The files in the /var/spool subdirectories should not be modified directly. The atq command lists all queued at jobs. The atrm command or at d command can be used to delete a job. A similar set of commands is used to manage cron jobs. The l option of crontab lists jobs. The r option removes jobs and the e option can be used to edit jobs.

The Complete Guide to Linux System Administration

6-6

Students should create scheduled tasks using crontab and at, then view the /var/spool subdirectories to find the files corresponding to their commands.

Controlling Access to at and crontab

Default Linux permissions allow any user to submit at or cron jobs. Administrators can use the /etc/cron.allow, /etc/cron.deny, /etc/at.allow, and /etc/at.deny files to specify which users may or may not use these commands.

Quick Quiz
1. 2. 3. _____ linked applications assume that any needed library files are available on the Linux system. ANSWER: Dynamically True or False: The free command displays information about RAM and virtual memory. ANSWER: True A scheduled task is often called a(n) _____. ANSWER: job

Discussion Questions
1. 2. 3. 4. 5. What are the benefits of the hierarchical system of creating processes where one process descends from another? What type of processes normally run in the background? Would you prefer to use graphical or command-line tools to monitor system load? What steps can you take to ensure that memory is used most efficiently? What type of tasks would you perform using at, batch, and crontab?